Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1026e6ec2979d410eb6f08d46bd1123ea36b303e29ec14a3de57eb771315bef7.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
1026e6ec2979d410eb6f08d46bd1123ea36b303e29ec14a3de57eb771315bef7.exe
-
Size
129KB
-
MD5
2715b614e2e7b006e0e77781e1929cc4
-
SHA1
b7b40ea88f83b7ffbf2215944587358fcb946610
-
SHA256
1026e6ec2979d410eb6f08d46bd1123ea36b303e29ec14a3de57eb771315bef7
-
SHA512
9d7d572b7fe3b4af68e64a202fbd6268a9fdd6adc2d6788f56ccdd44a81871100b8334102e7d68d872a9325f109ff3b3f4c6187b2def68330dbae4e7ed0fb59f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX/x6gto:n3C9BRW0j/uVEZFJvu
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4532-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1864-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/852-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/444-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 33 IoCs
resource yara_rule behavioral2/memory/4532-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1864-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4948-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4084-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4040-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2572-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2572-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2572-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1232-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1296-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/816-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/816-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3468-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/852-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4224-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4352-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1960-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/444-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2552-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2468-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2036-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/8-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5116-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4832-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/232-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1176-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4860 lxxrlfx.exe 4948 3llxlfr.exe 1864 bbthtn.exe 4084 dvvpj.exe 4040 btthtn.exe 3576 vddpj.exe 2572 dpppj.exe 1232 rlllrrr.exe 1296 bbnhbt.exe 816 jjppd.exe 4672 llfrrlf.exe 3468 7hhbnb.exe 852 bntnbt.exe 4224 jdjdd.exe 4352 lllxxrf.exe 1960 ttthnn.exe 444 vdjvj.exe 4768 xrrffxr.exe 1708 hnhttb.exe 2552 dvppv.exe 2468 dpjdj.exe 2036 flrlfxr.exe 8 ttnnnh.exe 5116 vpvpd.exe 4988 xxxrfrl.exe 5056 xxxrxfr.exe 1568 jjjdd.exe 4832 llxfllf.exe 232 5rrxxxf.exe 1176 tnhtnn.exe 1084 ddvjv.exe 1476 5lllxfr.exe 4936 llllfxr.exe 4828 jjvdj.exe 5052 xrfxrlf.exe 3416 fllfxrl.exe 2892 nntnbt.exe 2292 hnbbtb.exe 4084 jjjdp.exe 2012 jpdjp.exe 2268 3xrrxfr.exe 4820 nnnhtn.exe 4292 hbtthb.exe 1964 jddpd.exe 3688 9jjvv.exe 4520 frrlxrl.exe 448 ntnbth.exe 4672 tbhntn.exe 2396 pjjjv.exe 2844 nhtnbt.exe 4744 bntbnt.exe 1588 jdjjd.exe 1428 vvjdj.exe 2656 lfxlfxr.exe 2848 fxxxrrl.exe 1688 bnttnt.exe 4608 tntbth.exe 1892 7jvjd.exe 4068 5dvpp.exe 1048 5frlxxr.exe 4548 thtnnn.exe 3536 nnbbbb.exe 3192 dvpdv.exe 8 ppjdj.exe -
resource yara_rule behavioral2/memory/4532-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/852-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/444-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 4860 4532 1026e6ec2979d410eb6f08d46bd1123ea36b303e29ec14a3de57eb771315bef7.exe 88 PID 4532 wrote to memory of 4860 4532 1026e6ec2979d410eb6f08d46bd1123ea36b303e29ec14a3de57eb771315bef7.exe 88 PID 4532 wrote to memory of 4860 4532 1026e6ec2979d410eb6f08d46bd1123ea36b303e29ec14a3de57eb771315bef7.exe 88 PID 4860 wrote to memory of 4948 4860 lxxrlfx.exe 89 PID 4860 wrote to memory of 4948 4860 lxxrlfx.exe 89 PID 4860 wrote to memory of 4948 4860 lxxrlfx.exe 89 PID 4948 wrote to memory of 1864 4948 3llxlfr.exe 90 PID 4948 wrote to memory of 1864 4948 3llxlfr.exe 90 PID 4948 wrote to memory of 1864 4948 3llxlfr.exe 90 PID 1864 wrote to memory of 4084 1864 bbthtn.exe 91 PID 1864 wrote to memory of 4084 1864 bbthtn.exe 91 PID 1864 wrote to memory of 4084 1864 bbthtn.exe 91 PID 4084 wrote to memory of 4040 4084 dvvpj.exe 92 PID 4084 wrote to memory of 4040 4084 dvvpj.exe 92 PID 4084 wrote to memory of 4040 4084 dvvpj.exe 92 PID 4040 wrote to memory of 3576 4040 btthtn.exe 93 PID 4040 wrote to memory of 3576 4040 btthtn.exe 93 PID 4040 wrote to memory of 3576 4040 btthtn.exe 93 PID 3576 wrote to memory of 2572 3576 vddpj.exe 95 PID 3576 wrote to memory of 2572 3576 vddpj.exe 95 PID 3576 wrote to memory of 2572 3576 vddpj.exe 95 PID 2572 wrote to memory of 1232 2572 dpppj.exe 96 PID 2572 wrote to memory of 1232 2572 dpppj.exe 96 PID 2572 wrote to memory of 1232 2572 dpppj.exe 96 PID 1232 wrote to memory of 1296 1232 rlllrrr.exe 97 PID 1232 wrote to memory of 1296 1232 rlllrrr.exe 97 PID 1232 wrote to memory of 1296 1232 rlllrrr.exe 97 PID 1296 wrote to memory of 816 1296 bbnhbt.exe 98 PID 1296 wrote to memory of 816 1296 bbnhbt.exe 98 PID 1296 wrote to memory of 816 1296 bbnhbt.exe 98 PID 816 wrote to memory of 4672 816 jjppd.exe 99 PID 816 wrote to memory of 4672 816 jjppd.exe 99 PID 816 wrote to memory of 4672 816 jjppd.exe 99 PID 4672 wrote to memory of 3468 4672 llfrrlf.exe 100 PID 4672 wrote to memory of 3468 4672 llfrrlf.exe 100 PID 4672 wrote to memory of 3468 4672 llfrrlf.exe 100 PID 3468 wrote to memory of 852 3468 7hhbnb.exe 101 PID 3468 wrote to memory of 852 3468 7hhbnb.exe 101 PID 3468 wrote to memory of 852 3468 7hhbnb.exe 101 PID 852 wrote to memory of 4224 852 bntnbt.exe 102 PID 852 wrote to memory of 4224 852 bntnbt.exe 102 PID 852 wrote to memory of 4224 852 bntnbt.exe 102 PID 4224 wrote to memory of 4352 4224 jdjdd.exe 103 PID 4224 wrote to memory of 4352 4224 jdjdd.exe 103 PID 4224 wrote to memory of 4352 4224 jdjdd.exe 103 PID 4352 wrote to memory of 1960 4352 lllxxrf.exe 104 PID 4352 wrote to memory of 1960 4352 lllxxrf.exe 104 PID 4352 wrote to memory of 1960 4352 lllxxrf.exe 104 PID 1960 wrote to memory of 444 1960 ttthnn.exe 105 PID 1960 wrote to memory of 444 1960 ttthnn.exe 105 PID 1960 wrote to memory of 444 1960 ttthnn.exe 105 PID 444 wrote to memory of 4768 444 vdjvj.exe 106 PID 444 wrote to memory of 4768 444 vdjvj.exe 106 PID 444 wrote to memory of 4768 444 vdjvj.exe 106 PID 4768 wrote to memory of 1708 4768 xrrffxr.exe 107 PID 4768 wrote to memory of 1708 4768 xrrffxr.exe 107 PID 4768 wrote to memory of 1708 4768 xrrffxr.exe 107 PID 1708 wrote to memory of 2552 1708 hnhttb.exe 108 PID 1708 wrote to memory of 2552 1708 hnhttb.exe 108 PID 1708 wrote to memory of 2552 1708 hnhttb.exe 108 PID 2552 wrote to memory of 2468 2552 dvppv.exe 109 PID 2552 wrote to memory of 2468 2552 dvppv.exe 109 PID 2552 wrote to memory of 2468 2552 dvppv.exe 109 PID 2468 wrote to memory of 2036 2468 dpjdj.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\1026e6ec2979d410eb6f08d46bd1123ea36b303e29ec14a3de57eb771315bef7.exe"C:\Users\Admin\AppData\Local\Temp\1026e6ec2979d410eb6f08d46bd1123ea36b303e29ec14a3de57eb771315bef7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\3llxlfr.exec:\3llxlfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\bbthtn.exec:\bbthtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\dvvpj.exec:\dvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\btthtn.exec:\btthtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\vddpj.exec:\vddpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\dpppj.exec:\dpppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rlllrrr.exec:\rlllrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\bbnhbt.exec:\bbnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\jjppd.exec:\jjppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\llfrrlf.exec:\llfrrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\7hhbnb.exec:\7hhbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\bntnbt.exec:\bntnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\jdjdd.exec:\jdjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\lllxxrf.exec:\lllxxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\ttthnn.exec:\ttthnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\vdjvj.exec:\vdjvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\xrrffxr.exec:\xrrffxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\hnhttb.exec:\hnhttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\dvppv.exec:\dvppv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\dpjdj.exec:\dpjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\flrlfxr.exec:\flrlfxr.exe23⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ttnnnh.exec:\ttnnnh.exe24⤵
- Executes dropped EXE
PID:8 -
\??\c:\vpvpd.exec:\vpvpd.exe25⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xxxrfrl.exec:\xxxrfrl.exe26⤵
- Executes dropped EXE
PID:4988 -
\??\c:\xxxrxfr.exec:\xxxrxfr.exe27⤵
- Executes dropped EXE
PID:5056 -
\??\c:\jjjdd.exec:\jjjdd.exe28⤵
- Executes dropped EXE
PID:1568 -
\??\c:\llxfllf.exec:\llxfllf.exe29⤵
- Executes dropped EXE
PID:4832 -
\??\c:\5rrxxxf.exec:\5rrxxxf.exe30⤵
- Executes dropped EXE
PID:232 -
\??\c:\tnhtnn.exec:\tnhtnn.exe31⤵
- Executes dropped EXE
PID:1176 -
\??\c:\ddvjv.exec:\ddvjv.exe32⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5lllxfr.exec:\5lllxfr.exe33⤵
- Executes dropped EXE
PID:1476 -
\??\c:\llllfxr.exec:\llllfxr.exe34⤵
- Executes dropped EXE
PID:4936 -
\??\c:\tbtttb.exec:\tbtttb.exe35⤵PID:1572
-
\??\c:\jjvdj.exec:\jjvdj.exe36⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe37⤵
- Executes dropped EXE
PID:5052 -
\??\c:\fllfxrl.exec:\fllfxrl.exe38⤵
- Executes dropped EXE
PID:3416 -
\??\c:\nntnbt.exec:\nntnbt.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hnbbtb.exec:\hnbbtb.exe40⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jjjdp.exec:\jjjdp.exe41⤵
- Executes dropped EXE
PID:4084 -
\??\c:\jpdjp.exec:\jpdjp.exe42⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3xrrxfr.exec:\3xrrxfr.exe43⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nnnhtn.exec:\nnnhtn.exe44⤵
- Executes dropped EXE
PID:4820 -
\??\c:\hbtthb.exec:\hbtthb.exe45⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jddpd.exec:\jddpd.exe46⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9jjvv.exec:\9jjvv.exe47⤵
- Executes dropped EXE
PID:3688 -
\??\c:\frrlxrl.exec:\frrlxrl.exe48⤵
- Executes dropped EXE
PID:4520 -
\??\c:\ntnbth.exec:\ntnbth.exe49⤵
- Executes dropped EXE
PID:448 -
\??\c:\tbhntn.exec:\tbhntn.exe50⤵
- Executes dropped EXE
PID:4672 -
\??\c:\pjjjv.exec:\pjjjv.exe51⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nhtnbt.exec:\nhtnbt.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bntbnt.exec:\bntbnt.exe53⤵
- Executes dropped EXE
PID:4744 -
\??\c:\jdjjd.exec:\jdjjd.exe54⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vvjdj.exec:\vvjdj.exe55⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe56⤵
- Executes dropped EXE
PID:2656 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe57⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bnttnt.exec:\bnttnt.exe58⤵
- Executes dropped EXE
PID:1688 -
\??\c:\tntbth.exec:\tntbth.exe59⤵
- Executes dropped EXE
PID:4608 -
\??\c:\7jvjd.exec:\7jvjd.exe60⤵
- Executes dropped EXE
PID:1892 -
\??\c:\5dvpp.exec:\5dvpp.exe61⤵
- Executes dropped EXE
PID:4068 -
\??\c:\5frlxxr.exec:\5frlxxr.exe62⤵
- Executes dropped EXE
PID:1048 -
\??\c:\thtnnn.exec:\thtnnn.exe63⤵
- Executes dropped EXE
PID:4548 -
\??\c:\nnbbbb.exec:\nnbbbb.exe64⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dvpdv.exec:\dvpdv.exe65⤵
- Executes dropped EXE
PID:3192 -
\??\c:\ppjdj.exec:\ppjdj.exe66⤵
- Executes dropped EXE
PID:8 -
\??\c:\3rfxllx.exec:\3rfxllx.exe67⤵PID:2044
-
\??\c:\nhbttt.exec:\nhbttt.exe68⤵PID:1164
-
\??\c:\nbhhbb.exec:\nbhhbb.exe69⤵PID:3860
-
\??\c:\ppjjd.exec:\ppjjd.exe70⤵PID:3292
-
\??\c:\pjvjd.exec:\pjvjd.exe71⤵PID:1704
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe72⤵PID:552
-
\??\c:\bbhbbb.exec:\bbhbbb.exe73⤵PID:1496
-
\??\c:\7hnnbt.exec:\7hnnbt.exe74⤵PID:312
-
\??\c:\dpdvp.exec:\dpdvp.exe75⤵PID:3936
-
\??\c:\ppvpv.exec:\ppvpv.exe76⤵PID:4496
-
\??\c:\xflxfxf.exec:\xflxfxf.exe77⤵PID:4412
-
\??\c:\hhhbtn.exec:\hhhbtn.exe78⤵PID:3700
-
\??\c:\3ttnnh.exec:\3ttnnh.exe79⤵PID:4492
-
\??\c:\ddvvv.exec:\ddvvv.exe80⤵PID:3684
-
\??\c:\pppjv.exec:\pppjv.exe81⤵PID:5052
-
\??\c:\xllxlfx.exec:\xllxlfx.exe82⤵PID:4752
-
\??\c:\tbthhb.exec:\tbthhb.exe83⤵PID:3100
-
\??\c:\bbnthh.exec:\bbnthh.exe84⤵PID:4528
-
\??\c:\pjvpv.exec:\pjvpv.exe85⤵PID:460
-
\??\c:\pvvpp.exec:\pvvpp.exe86⤵PID:4880
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe87⤵PID:3576
-
\??\c:\nnbntb.exec:\nnbntb.exe88⤵PID:3232
-
\??\c:\ttttnb.exec:\ttttnb.exe89⤵PID:4636
-
\??\c:\pdddv.exec:\pdddv.exe90⤵PID:3252
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe91⤵PID:3032
-
\??\c:\lffxrxr.exec:\lffxrxr.exe92⤵PID:1308
-
\??\c:\hbhnht.exec:\hbhnht.exe93⤵PID:5108
-
\??\c:\tttthh.exec:\tttthh.exe94⤵PID:5088
-
\??\c:\vjvpj.exec:\vjvpj.exe95⤵PID:3172
-
\??\c:\rlxxffl.exec:\rlxxffl.exe96⤵PID:852
-
\??\c:\fxxxfff.exec:\fxxxfff.exe97⤵PID:4544
-
\??\c:\7nnhhh.exec:\7nnhhh.exe98⤵PID:4400
-
\??\c:\1ttnhb.exec:\1ttnhb.exe99⤵PID:1460
-
\??\c:\1vvpv.exec:\1vvpv.exe100⤵PID:1960
-
\??\c:\rlllfff.exec:\rlllfff.exe101⤵PID:3724
-
\??\c:\lfllfff.exec:\lfllfff.exe102⤵PID:3256
-
\??\c:\hnhnnn.exec:\hnhnnn.exe103⤵PID:3932
-
\??\c:\tntthn.exec:\tntthn.exe104⤵PID:1708
-
\??\c:\pjvpp.exec:\pjvpp.exe105⤵PID:2148
-
\??\c:\xxxffrr.exec:\xxxffrr.exe106⤵PID:2108
-
\??\c:\1flfxxf.exec:\1flfxxf.exe107⤵PID:4368
-
\??\c:\hhhhhh.exec:\hhhhhh.exe108⤵PID:4376
-
\??\c:\bbtbnb.exec:\bbtbnb.exe109⤵PID:4364
-
\??\c:\bhhthh.exec:\bhhthh.exe110⤵PID:5024
-
\??\c:\dvddj.exec:\dvddj.exe111⤵PID:1784
-
\??\c:\dpvjp.exec:\dpvjp.exe112⤵PID:396
-
\??\c:\lllllll.exec:\lllllll.exe113⤵PID:1568
-
\??\c:\flrxrrl.exec:\flrxrrl.exe114⤵PID:3604
-
\??\c:\nttttt.exec:\nttttt.exe115⤵PID:3500
-
\??\c:\hhtbbn.exec:\hhtbbn.exe116⤵PID:2364
-
\??\c:\pvddv.exec:\pvddv.exe117⤵PID:2816
-
\??\c:\vjjjd.exec:\vjjjd.exe118⤵PID:4456
-
\??\c:\fxfxfrr.exec:\fxfxfrr.exe119⤵PID:4412
-
\??\c:\3xrrrrr.exec:\3xrrrrr.exe120⤵PID:1028
-
\??\c:\tttthh.exec:\tttthh.exe121⤵PID:2604
-
\??\c:\nntnhh.exec:\nntnhh.exe122⤵PID:3416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-